EC-COUNCIL 212-89 Online Practice Questions and Exam Preparation

EC-COUNCIL 212-89 Online Questions & Answers

• Question 81:

  Miko was hired as an incident handler in XYZ company. His first task was to identify the PING sweep attempts inside the network. For this purpose, he used Wireshark to analyze the traffic. What filter did he use to identify ICMP ping sweep attempts?

  A. tcp.typc == icmp
  B. icrrip.lype == icmp
  C. icmp.type == 8 or icmp.type ==0
  D. udp.lype - 7
  C. icmp.type == 8 or icmp.type ==0

  ---

  In Wireshark, to identify ICMP ping sweep attempts, the filter icmp.type == 8 or icmp.type ==0 is used. This filter captures ICMP echo requests and echo replies, which are indicative of ping commands. Type 8 represents an echo request used when a source sends a ping, and type 0 represents an echo reply, which is the response from the target. By filtering for these ICMP types, Miko can detect a surge in ping requests across the network, which could indicate a ping sweep attempt-an exploratory activity often used by attackers to discover active hosts on a network by sending ping requests to multiple addresses.

  References: Incident Handler (ECIH v3) courses and study guides often incorporate training on using network analysis tools like Wireshark, including how to use filters to detect specific types of network activities and potential threats.

• Question 82:

  Identify the malicious program that is masked as a genuine harmless program and gives the attacker unrestricted access to the user's information and system. These programs may unleash dangerous programs that may erase the unsuspecting user's disk and send the victim's credit card numbers and passwords to a stranger.

  A. Worm
  B. Adware
  C. Virus
  D. Trojan
  D. Trojan

  ---

  A Trojan, or Trojan horse, is a type of malware that disguises itself as a legitimate, harmless program or file to trick users into downloading and installing it. Once activated, a Trojan can perform a range of malicious activities, including giving attackers unauthorized access to the infected system. This can lead to the theft of sensitive information, such as credit card numbers and passwords, and can also allow the attacker to install additional malware, potentially leading to further damage, such as the erasure of data. Unlike viruses and worms, Trojans do not replicate themselves but rely on the deception of users to spread.

  References: The Incident Handler (ECIH v3) course materials cover various types of malware, including Trojans, and their characteristics. The curriculum emphasizes the importance of understanding how different types of malicious software operate to effectively manage and respond to security incidents involving such threats.

• Question 83:

  Which of the following details are included in the evidence bags?

  A. Error messages that contain sensitive information and files containing passworos
  B. Software version information and web application source code
  C. Sensitive cirectories, personal, and organizational email adcress
  D. Date and time of seizure, exhibit number, anc name of incident responder
  B. Software version information and web application source code

  ---

  In the practice of digital forensics and incident handling, evidence bags play a crucial role in preserving the integrity and chain of custody of physical and digital evidence. The information typically included in the documentation on evidence bags encompasses the date and time of seizure, which provides a timestamp for when the evidence was collected; the exhibit number, which is a unique identifier assigned to each piece of evidence for tracking and reference purposes; and the name of the incident responder or individual who collected the evidence, ensuring accountability and traceability. This documentation is essential for maintaining the chain of custody, a critical element in legal proceedings, as it helps establish the evidence's authenticity and integrity by detailing its handling from collection to presentation in court. Options A, B, and C describe types of digital evidence but are not directly related to the content typically documented on evidence bags.

  References: Incident Handler (ECIH v3) courses and study guides emphasize the importance of accurately documenting evidence bags as part of the evidence collection and preservation process in incident handling and digital forensics.

• Question 84:

  Mike is an incident handler for PNP Infosystems Inc. One day, there was a ticket submitted regarding a critical incident and Mike was assigned to handle the incident. During the process of incident handling, at one stage, he performed incident analysis and validation to check whether the incident is a genuine incident or a false positive. Identify the stage he is currently in.

  A. Post-incident activities
  B. Incident disclosure
  C. Incident recording and assignment
  D. Incident triage
  D. Incident triage

  ---

  Incident triage is the stage in the incident response process where the incident handler, like Mike, performs an initial assessment of the reported incident to determine its validity, severity, and potential impact. This includes analyzing the incident to verify if it is a genuine threat or a false positive. The purpose of incident triage is to prioritize incidents based on their criticality and ensure that resources are allocated effectively to address the most serious threats first. This stage is crucial for efficient incident management, as it helps in filtering out false alarms and focusing on real security incidents that require immediate attention.

  References: The ECIH v3 curriculum covers the incident response lifecycle, including the importance of incident triage as a key step in ensuring that incident handling efforts are focused on genuine security incidents, thereby optimizing the response process.

• Question 85:

  Which of the following is a risk assessment tool:

  A. Nessus
  B. Wireshark
  C. CRAMM
  D. Nmap
  C. CRAMM

  ---

  Explanation

• Question 86:

  Alexis works as an incident responder at XYZ organization. She was asked to identify and attribute the actors behind an attack that occurred recently. For this purpose, she is performing a type of threat attribution that deals with the identification of a specific person, society, or country sponsoring a well-planned and executed intrusion or attack on its target. Which of the following types of threat attributions is Alexis performing?

  A. Campaign attribution
  B. True attribution
  C. Nation-state attribution
  D. Intrusion set attribution
  C. Nation-state attribution

  ---

  Nation-state attribution involves identifying a specific country or government as the sponsor behind a cyber- attack or intrusion. This type of threat attribution is focused on determining the involvement of state actors in cyber operations against specific targets, which often involves sophisticated, well-planned, and executed cyber campaigns. Alexis's efforts to identify and attribute the actors behind the attack to a specific nation-state fall under this category, as she seeks to uncover the geopolitical motives and the extent of state sponsorship behind the incident. Nation-state attribution requires analyzing a variety of indicators, including technical evidence, tactics, techniques, and procedures (TTPs), and contextual intelligence. This is distinct from campaign attribution, which focuses on linking attacks to a specific campaign or operation, true attribution, which aims at identifying the actual individuals behind an attack, and intrusion set attribution, which involves attributing a set of malicious activities to a particular threat actor or group.

  References: The Incident Handler (ECIH v3) certification program includes discussions on various types of threat attributions, highlighting the challenges and methodologies involved in attributing cyber-attacks to specific actors, including nation-states.

• Question 87:

  You are a systems administrator for a company. You are accessing your file server remotely for maintenance. Suddenly, you are unable to access the server. After contacting others in your department, you find out that they cannot access the file server either. You can ping the file server but not connect to it via RDP. You check the Active Directory Server, and all is well. You check the email server and find that emails are sent and received normally. What is the most likely issue?

  A. An e-mail service issue
  B. The file server has shut down
  C. A denial-of-service issue
  D. An admin account issue
  C. A denial-of-service issue

  ---

  In this scenario, the inability to access the file server via Remote Desktop Protocol (RDP), despite the server being pingable and other services functioning normally, suggests a service-specific disruption rather than a complete system shutdown or broader network issue. This pattern is indicative of a denial-of-service (DoS) attack targeted at the file server's RDP service or network congestion that specifically affects RDP connectivity. A DoS attack aims to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to the Internet. The fact that other services (like email) are operational rules out broader system or admin account issues, pointing towards a specific problem with accessing the file server, most likely due to a denial-of-service condition.

  References: Incident Handler (ECIH v3) courses teach systems administrators and security professionals to diagnose and respond to various security incidents, including DoS attacks, by understanding symptoms and isolating issues based on the services affected.

• Question 88:

  During an incident investigation, an incident handler identifies that critical system logs were overwritten due to improper log retention policies. Which principle of incident readiness was primarily violated?

  A. Evidence admissibility
  B. Evidence availability
  C. Chain of custody
  D. Incident escalation
  B. Evidence availability

  ---

  Explanation

  Evidence availability ensures that relevant logs, records, and digital artifacts are retained and accessible when an incident occurs. Improper log retention leading to overwritten logs directly impacts the ability of incident handlers to analyze events, timelines, and attacker actions. Without available logs, investigations become incomplete and unreliable.

• Question 89:

  They type of attack that prevents the authorized users to access networks, systems, or applications by exhausting the network resources and sending illegal requests to an application is known as:

  A. Session Hijacking attack
  B. Denial of Service attack
  C. Man in the Middle attack
  D. SQL injection attack
  B. Denial of Service attack

  ---

  Explanation

• Question 90:

  After a recent email attack, Harry is analyzing the incident to obtain important information related to the incident. While investigating the incident, he is trying to extract information such as sender identity, mail server, sender's IP address, location, and so on. Which of the following tools Harry must use to perform this task?

  A. Clamwin
  B. Logly
  C. Yesware
  D. Sharp
  C. Yesware

  ---

  Yesware is a tool primarily known for its email tracking capabilities, which can be useful for sales, marketing, and customer relationship management. However, in the context of investigating email attacks and analyzing incidents to extract details such as sender identity, mail server, sender's IP address, and location, a more appropriate tool would be one that specializes in analyzing and extracting detailed header information from emails, providing insights into the path an email took across the internet. While Yesware can provide data related to email interactions, it might not offer the depth of forensic analysis required for incident investigation. Tools like email header analyzers, which are designed specifically for dissecting and interpreting email headers, would be more fitting. In the absence of a direct match from the given options, the description might imply a broader interpretation of tools like Yesware in context but traditionally, tools specifically designed for email forensics would be sought after for this task.

  References: Understanding email headers and using tools to analyze them is an important part of email incident response, as discussed in cybersecurity training programs like ECIH v3 by EC-Council, which covers the methodologies for analyzing various types of cybersecurity incidents, including email-based threats.